Best Practices for Securing WooCommerce for HIPAA eCommerce

Securing WooCommerce for HIPAA Compliance

HIPAA (Health Insurance Portability and Accountability Act) compliance is a very important aspect of online healthcare businesses, but it is also quite tricky to achieve if one does not start correctly. There are several important rules a business has to obey by in order to be HIPAA compliant, and they have to do mostly with the security and privacy of sensitive patience information, or, as commonly known, protected health information (PHI). A major issue towards securing PHI (or ePHI, when submitted online), is securing the platform used for eCommerce. In this article, we will explore ways to ensure HIPAA compliance of healthcare eCommerce platforms, by securing WordPress and WooCommerce.

How Can you Secure WooCommerce for HIPAA eCommerce?

In order to overcome the issues arising from the WooCommerce not being HIPAA compliant, and ensure the protection of ePHI and the anonymity of customers, there are several steps that can be taken from someone hosting an eCommerce platform in the healthcare sector.

• The first step is to implement the Privacy and Security Rule, as stated by HIPAA. This might require the need for a team to be set up and work towards this goal, as there several guidelines and points of attention within both rules.
• Secure HIPAA-compliant hosting is another action that can work towards ePHI security, as if the host of the website is “bulletproof”, potential attacks and ePHI breaches could be unsuccessful. Choosing a host which proactively looks out for the protection of its clients, by keeping up with security updates and needed patches, applying the latest measures, monitoring and preventing attacks, and having the ability to efficiently isolate incidents from spreading, should be one of the first things to look out for when setting up an eCommerce platform.
• Implementing a multi-factor authentication is also advisable, as it reinforces the authentication process and can prevent unauthorized access to sensitive information. Usually two-factor authentication is followed, where upon submitting username and password to access your account, there is an intermediate step where you have to also submit a unique code supplied through an external source (e.g. telephone, email).
• Another step towards reinforcement of ePHI security on a WooCommerce eCommerce platform, is the use of plugins, on top of the existing security measures taken from the host. There are several plugin options, free of charge, or on a monthly or yearly paid plan, offering anything, from file integrity monitoring, malware scanning, and password enforcement, to backups, real-time threat detection, and malicious comment prevention. Some options for security plugins are the following: WP fail2ban, All in One WP Security & Firewall, Jetpack, Sucuri Security, BulletProof Security, Security Ninja, and Defender, without this list being exhaustive.

WooCommerce Integration for a HIPAA-Compliant Future

The concept “less is more” does not apply in WooCommerce HIPAA security requirements, here, “more is always better”. Besides the externally implemented steps shown previously, there are a few other steps a business owner can take to secure their WooCommerce platform. These have to do with tokenization and external storage of sensitive data, and encryption of files and data.

• Tokenization of sensitive data: this approach, combined with safe storage of such data outside the host’s environment, is a great option for security enhancement. What it means, is that there is no sensitive information stored within the potentially unsafe WooCommerce environment, but everything is directly stored externally, on a safe, and HIPAA compliant, business associate, or a secure vault. The act of tokenization refers to the replacement of ePHI with information which is not valuable. A great example of this practice is online payments, where credit card information is tokenized and stored on the server of the plugin which handles the payment, rather than the server of the website selling the product. This could be applied with other ePHI, where submitted information through forms or other portals can be directly stored externally, through WooCommerce HIPAA eCommerce integration with an ERP solution.
• Data encryption: an added veil of security, towards satisfying the WooCommerce HIPAA security requirements, is to encrypt data. In this case, even if there is a data breach, it will be that much more difficult for someone to use the data, without access to the keys to decrypt. Encryption can easily be performed by easy-to-install plugins, providing data security, as raw data will not be present on the potentially insecure server.